WO2016082275A1 - Procédé d'authentification de chemin bgp en se basant sur la surveillance saut par saut - Google Patents

Procédé d'authentification de chemin bgp en se basant sur la surveillance saut par saut Download PDF

Info

Publication number
WO2016082275A1
WO2016082275A1 PCT/CN2014/095174 CN2014095174W WO2016082275A1 WO 2016082275 A1 WO2016082275 A1 WO 2016082275A1 CN 2014095174 W CN2014095174 W CN 2014095174W WO 2016082275 A1 WO2016082275 A1 WO 2016082275A1
Authority
WO
WIPO (PCT)
Prior art keywords
hop
data packet
bgp
route
path
Prior art date
Application number
PCT/CN2014/095174
Other languages
English (en)
Chinese (zh)
Inventor
延志伟
王翠翠
Original Assignee
中国科学院计算机网络信息中心
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国科学院计算机网络信息中心 filed Critical 中国科学院计算机网络信息中心
Publication of WO2016082275A1 publication Critical patent/WO2016082275A1/fr

Links

Images

Definitions

  • the invention belongs to the technical field of networks, and in particular relates to a BGP route verification method based on hop-by-hop supervision.
  • BGP Bit Gateway Protocol
  • ARPANET Advanced Routing Protocol
  • RFC827 proposes a solution to transform ARPANET from a single co-managed network to a network interconnected by multiple Autonomous Systems (AS).
  • An autonomous system also known as an autonomous domain, is managed by an independent entity.
  • intra-domain routing protocols such as OSPF and RIP can be freely selected, and the same inter-domain routing protocol is used between the autonomous domains.
  • the original inter-domain routing protocol is the EGP (Exterior Gateway Protocol) used in ARPANET.
  • the EGP protocol can be said to be the prototype of the BGP protocol design. It is applicable to the early backbone network-based ARPANET and only supports the tree topology. As the topology of the Internet gradually changes from tree to mesh, the EGP protocol is difficult to adapt to the new network environment. At this point, the BGP protocol emerged as a replacement for the EGP protocol.
  • BGP The first BGP protocol version was developed in RFC 1105. After several revisions by the IETF IDR Working Group, the actual version running on the Internet is currently BGP-4.
  • BGP is a path vector protocol that supports CIDR, route aggregation, and flexible routing strategies.
  • BGP has made a significant contribution to the commercialization and globalization of the Internet.
  • the design of the BGP protocol leaves a huge flaw in security, which directly leads to many major events in the history of Internet security. More well-known are the AS7007 mismatch event in 1997, the TTNet route injection event in 2004, the YouTube hijacking in 2008, and the Australian network disruption in 2012.
  • the design flaws of the BGP protocol have also made hackers increasingly interested in BGP attacks. For example, at the DEFCON hacking Conference in 2008, two speakers demonstrated an attack method for man-in-the-middle attacks on BGP to implement traffic hijacking. All of these security incidents and attacks are fully exposed to the security vulnerabilities of BGP routing protocols.
  • BGP security is also an important research direction in the field of network security. Many researchers and security organizations have been conducting in-depth research on it. More typical S-BGP designed by BBN, Cisco's soBGP and IETF Secure Inter-Domain Routing (SIDR) working group are developing the RPKI & BGPsec protocol. These provide technical ideas and efforts to solve BGP security problems.
  • RPKI & BGPsec has become the practical standard for large-scale deployment in the future.
  • the standardization work of RPKI is basically completed. The architecture has been supported by ICANN to obtain the deployment of five RIRs (Regional Internet Registers). The standardization work of BGPsec is also It is in full swing.
  • the current allocation of IP addresses is hierarchical: the top of the hierarchy is IANA; under IANA are the five regional Internet Registries (RIRs) - the RIRs manage their own IP addresses and AS numbers;
  • the layers are National Internet Registries (NIRs) and Local Internet Registries (LIRs or ISPs) and so-called independent distribution holders (in some regions, Level 3 may also be solely assigned by ISP/LIR and independent Somebody constitutes).
  • IP address allocation can be naturally described by a hierarchical PKI - each certificate describes the allocation of an IP address (this description also applies to the assignment of AS numbers, but the AS number cannot be removed by RIR and NIR) The institutions outside are assigned again). Therefore, the IP address and AS number can be maintained by the same set of PKIs.
  • the primary problem solved by RPKI is whether an AS is the legal owner of an IP and whether an AS has a legal authorization to advertise an IP prefix (originality of originAS).
  • BGPsec carries important path information when it propagates routes.
  • the path information is used on the one hand to indicate the network topology that arrives at the route, and on the other hand for routing.
  • the path information propagated by BGP mainly includes network layer reachability information (NLRI) and path attribute.
  • the network layer reachability information includes an IP prefix (prefix) and a length, and is used to identify the CIDR address of the destination network.
  • the path attribute describes the special attribute of the route to the CIDR address.
  • the AS_PATH attribute lists a series of AS paths that have passed through to the destination network.
  • the NEXT_HOP attribute indicates the next hop address of the route.
  • the RPKI certificate issuance system is consistent with the existing address allocation and AS number allocation system. It issues resource certificates from IANA and RIR down to the end entity.
  • the end entity has a non-subdividable IP address resource that uses its own private key to sign a piece of information called route origination authorizations (ROA).
  • the ROA contains the IP address block of the end entity and the AS number specified by the end entity to advertise the segment address. All certificates and ROAs pass through a distributed RPKI repository system. For centralized and distributed, each BGP router can obtain various certificates and ROAs from its own ISP distribution point. By authenticating the ROA information with the end entity certificate, it is possible to verify whether the origin AS in the AS_PATH has the authorization to advertise the NLRI.
  • the routing message is included in the AS_PATH attribute in the form of an AS number. If the RPKI key is leaked, the BGP routing policy may be directly leaked.
  • BGPsec only guarantees the security of route establishment, but it cannot verify the actual packet forwarding of the AS according to the announced route.
  • the present invention is directed to the above problem, and provides a BGP route verification method based on hop-by-hop supervision.
  • BGP route verification based on hop-by-hop supervision is implemented.
  • a BGP route verification method based on hop-by-hop supervision the steps of which include:
  • the BF field is carried in the data packet from the AS egress, and the AS receiving the data packet uses the BF field for verification, and determines whether the data packet is correctly transmitted from the previous hop according to the established route. Thereby implementing BGP route verification based on hop-by-hop supervision.
  • step 1) the binary vector data structure Bloom Filter includes:
  • FBF which represents the Bloom Filter calculated by the AS of the entire path
  • CBF which indicates the Bloom Filter calculated by the AS after the data packet is processed by the AS
  • LBF which indicates the Bloom Filter calculated by the AS through which the packet passes before the last hop AS processing.
  • step 2 After receiving the BGP update packet (FB UPDATE) containing the FBF, the router first checks whether its own identity is included:
  • the router determines whether there is a direct peer node included in the FBF, and forwards the BGP update packet to the next hop AS included in the FBF;
  • step 3 performing BGP route verification is:
  • the data packet from an AS exit is added with an IP option (ASPATH), which carries three fields: FBF, CBF, and LBF.
  • ASPATH IP option
  • the FBF is encrypted by the receiving end AS public key to prevent tampering;
  • an AS After receiving the data packet, an AS first determines whether the LBF should be transferred to the CBF by sending the identifier of the AS in the previous hop packet (that is, whether the CBF is equal to the "LBF+ last hop AS identifier"). If yes, the AS considers the data packet. The previous hop is correctly transmitted according to the established route, so that the LBF is set to the value of CBF, and the "CBF+current AS identifier" is forwarded as the new CBF to the next hop; if the identifier of the previous hop AS cannot be inferred from From LBF to CBF, it is considered that the last hop AS sent an error, thereby feeding back an error message;
  • the last AS receives the data packet, it decrypts the FBF with its private key and checks whether the CBF and the FBF are the same: if they are the same, it indicates that the data packet is according to all routers. The established path and policy forwarding; otherwise, indicating that the data packet is not forwarded according to the predetermined path, the data originating end is directly notified.
  • the RPKI system implements a trusted allocation and verification mechanism between Internet code numbers (AS numbers and IP addresses), and implements a trusted authentication system (BGPsec) in the process of establishing BGP routes.
  • AS numbers and IP addresses Internet code numbers
  • BGPsec trusted authentication system
  • the present invention has the following beneficial effects:
  • Figure 1 is a flow chart of routing updates in an embodiment.
  • FIG. 2 is a flow chart of packet forwarding in the embodiment.
  • the problem of the BGPsec basic protocol (as described in the background art) is the main starting point of the BGP route verification mechanism based on the Bloom Filter for hop-by-hop supervision.
  • the present invention includes three Bloom Filters in a BGPsec packet:
  • CBF Current BF
  • Last BF The Bloom Filter calculated by the AS before the packet is processed by the previous hop AS.
  • the present invention divides the network state into two scenarios and their respective requirements:
  • Untrusted network status In the untrusted state between ASs, the main problem to be solved is whether the data packet can be transmitted according to the established path. If it is not transmitted according to the predetermined path, it should be accurately discovered.
  • the present invention uses RPKI to store the identity corresponding to each AS and its public key to provide support for the above process.
  • RPKI RPKI
  • the details of the present invention are specifically described below.
  • the RPKI has provided a trusted architecture for maintaining the IP prefix information and verifiable identity information legally owned by the AS. In the present invention, it is required to expand on this basis, and add a globally unique identifier value to the center of the information maintained by the AS.
  • the AS number of the AS itself is also globally unique, but in order not to disclose the AS private information, the actual application
  • the BF value of the present invention can be calculated by using the AS number, and the value should be generated in a manner of up-and-down allocation and performed together with the allocation of the CA certificate. Suppose you need to number up to 65536 ASs.
  • the allocation rules can be as follows:
  • ⁇ IANA assigns several digits (such as 20 digits) to the five major RIRs.
  • a number of bits (such as 16 bits) after each RIR is used to uniquely number the ASs in its range.
  • the present invention uses BF to construct AS path information.
  • the Bloom filter is a binary vector data structure proposed by Howard Bloom in 1970. It has good space and time efficiency and is used to detect whether an element is a member of a set. If both values in the same position are all 0, the result is 0, otherwise it is 1.
  • the BF in the present invention is a calculation result of a character string generated by a plurality of AS numbers Hash.
  • the route update originating AS carries the FBF in the sent BGP route update message (in order to increase the deployment flexibility of the present invention, where the information is carried in the location is not specified in the present invention),
  • the AS is selected and compared with the FBF.
  • the AS selects the corresponding route update message forwarding interface.
  • the flow is shown in Figure 1.
  • the AS number/number refers to the AS number, such as AS 1024, AS 20334, the latter number is the AS number/number
  • the AS identifier refers to the number string processed in the present invention for generating BF.
  • the router After receiving the BGP UPDATE containing the FBF, the router first checks whether its own identity is included: if yes, it indicates that the message is correctly received, then the routing update corresponding to the NLRI is performed, and then the router judges the direct connection. Which of the peer nodes is included in the FBF, and the UPDATE continues to be forwarded to the next hop AS included in the FBF; if not, the router incorrectly accepts the UPDATE and then provides error feedback to the receiving interface. After receiving the error feedback and proving that the path is established incorrectly, the router returns an error message hop by hop until the source receives the re-planned path.
  • the routing update message can successfully pass the AS that should pass, but does not explicitly expose the completion path information corresponding to the NLRI (this function is irreversible based on the Bloom Filter calculation, that is, it cannot be inferred by reverse calculation whether an AS is included. In the Bloom Filter).
  • the router forwards the data according to the established route.
  • data forwarding needs to be verified, that is, the process described in step 4) below.
  • an IP option (ASPATH) is added to a packet from an AS exit (as this option is a TLV option for the IPv6 data hop-by-hop option header), which carries FBF, CBF, and LBF. Fields.
  • ASPATH IP option
  • TLV TLV option for the IPv6 data hop-by-hop option header
  • the FBF is protected from tampering by the receiving side AS public key encryption.
  • an AS first sends an AS identifier through the last hop packet to determine whether the LBF should be transferred to the CBF (that is, whether the CBF is Equivalent to "LBF + last hop AS ID"). If yes, the AS considers that the data packet is correctly transmitted from the previous hop according to the established route, so that the LBF is set to the value of CBF, and "CBF + current AS identifier" is used as The new CBF forwarding is a shock.
  • the last AS receives the data packet, it decrypts the FBF with its private key and checks whether the CBF and the FBF are the same: if they are the same, it indicates that the data packet is according to all routers. The established path and policy forwarding; otherwise, indicating that the data packet is not forwarded according to the predetermined path, the data originating end is directly notified.

Landscapes

  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

La présente invention concerne un procédé d'authentification de chemin BGP en se basant sur la surveillance saut par saut. Le procédé comprend les étapes suivantes : 1) ajout d'une valeur d'identifiant unique dans des informations maintenues par un système autonome (AS), et obtention par calcul d'un filtre de Bloom (BF) à structure de données vectorielle binaire conformément à la valeur d'identifiant unique; 2) construction d'informations de chemin AS en utilisant le BF, transport du BF dans un paquet de données de mise à jour BGP, comparaison du BF avec la valeur d'identifiant unique de l'AS, sélection d'une interface de transfert de message de mise à jour de chemin correspondant, et établissement d'un chemin BGP; 3) dans le procédé de transfert du paquet de données, transport d'un champ BF dans le paquet de données exporté depuis l'AS, de sorte qu'un AS recevant le paquet de données effectue l'authentification en utilisant le champ BF et détermine si le paquet de données est transmis correctement à partir du saut précédent conformément au chemin établi, obtenant ainsi l'authentification du chemin BGP sur la base de la surveillance saut par saut. La présente invention peut améliorer l'efficacité de l'authentification dans le processus d'établissement de chemin, et il est vérifié que le chemin annoncé et le chemin de transfert des données sont cohérents.
PCT/CN2014/095174 2014-11-27 2014-12-26 Procédé d'authentification de chemin bgp en se basant sur la surveillance saut par saut WO2016082275A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410705485.4 2014-11-27
CN201410705485.4A CN104468349B (zh) 2014-11-27 2014-11-27 一种基于逐跳监督的bgp路由验证方法

Publications (1)

Publication Number Publication Date
WO2016082275A1 true WO2016082275A1 (fr) 2016-06-02

Family

ID=52913749

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/095174 WO2016082275A1 (fr) 2014-11-27 2014-12-26 Procédé d'authentification de chemin bgp en se basant sur la surveillance saut par saut

Country Status (2)

Country Link
CN (1) CN104468349B (fr)
WO (1) WO2016082275A1 (fr)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112003822A (zh) * 2020-07-15 2020-11-27 互联网域名系统北京市工程研究中心有限公司 路由起源授权的质量检测方法和装置
CN112003959A (zh) * 2020-07-13 2020-11-27 互联网域名系统北京市工程研究中心有限公司 路由起源授权的自动签发方法和装置
CN113055829A (zh) * 2021-03-16 2021-06-29 深圳职业技术学院 一种网络广播信息的隐私保护方法、装置及可读存储介质
CN114124411A (zh) * 2021-12-07 2022-03-01 牙木科技股份有限公司 信息注册方法、信息认证方法、dns服务器及可读存储介质

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105523061B (zh) * 2015-12-21 2018-03-20 南京漫科智能科技有限公司 一种电锁器联锁的数据完全控制装置
CN106060014B (zh) * 2016-05-18 2019-04-26 中国互联网络信息中心 一种同时解决前缀劫持、路径劫持及路由泄露攻击的方法
CN107870925B (zh) * 2016-09-26 2021-08-20 华为技术有限公司 一种字符串过滤方法和相关装置
CN113162889B (zh) * 2020-01-22 2023-02-17 北京车和家信息技术有限公司 路由更新信息的认证方法及装置
CN113542116B (zh) * 2021-02-26 2023-02-21 互联网域名系统北京市工程研究中心有限公司 基于aspa改进的路径验证方法
CN114124811B (zh) * 2021-10-21 2023-08-01 中盈优创资讯科技有限公司 一种路由泄露实时监测方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101099340A (zh) * 2005-02-01 2008-01-02 思科技术公司 用于网络路径检测的系统和方法
CN101124785A (zh) * 2005-03-04 2008-02-13 思科技术公司 用于网络可达性检测的系统和方法
WO2014034097A1 (fr) * 2012-08-28 2014-03-06 Nec Corporation Système de commande de chemin, appareil de commande, nœud de bordure, procédé de commande de chemin et programme
CN104038384A (zh) * 2014-05-22 2014-09-10 中国电子科技集团公司第三十研究所 一种基于gbf的追踪溯源系统及其工作方法

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2529578A1 (fr) * 2010-01-29 2012-12-05 Telefonaktiebolaget LM Ericsson (publ) Routage de paquets dans un réseau

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101099340A (zh) * 2005-02-01 2008-01-02 思科技术公司 用于网络路径检测的系统和方法
CN101124785A (zh) * 2005-03-04 2008-02-13 思科技术公司 用于网络可达性检测的系统和方法
WO2014034097A1 (fr) * 2012-08-28 2014-03-06 Nec Corporation Système de commande de chemin, appareil de commande, nœud de bordure, procédé de commande de chemin et programme
CN104038384A (zh) * 2014-05-22 2014-09-10 中国电子科技集团公司第三十研究所 一种基于gbf的追踪溯源系统及其工作方法

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112003959A (zh) * 2020-07-13 2020-11-27 互联网域名系统北京市工程研究中心有限公司 路由起源授权的自动签发方法和装置
CN112003959B (zh) * 2020-07-13 2023-06-16 深圳网基科技有限公司 路由起源授权的自动签发方法和装置
CN112003822A (zh) * 2020-07-15 2020-11-27 互联网域名系统北京市工程研究中心有限公司 路由起源授权的质量检测方法和装置
CN112003822B (zh) * 2020-07-15 2022-11-01 互联网域名系统北京市工程研究中心有限公司 路由起源授权的质量检测方法和装置
CN113055829A (zh) * 2021-03-16 2021-06-29 深圳职业技术学院 一种网络广播信息的隐私保护方法、装置及可读存储介质
CN114124411A (zh) * 2021-12-07 2022-03-01 牙木科技股份有限公司 信息注册方法、信息认证方法、dns服务器及可读存储介质
CN114124411B (zh) * 2021-12-07 2024-01-09 牙木科技股份有限公司 信息注册方法、信息认证方法、dns服务器及存储介质

Also Published As

Publication number Publication date
CN104468349A (zh) 2015-03-25
CN104468349B (zh) 2017-11-14

Similar Documents

Publication Publication Date Title
WO2016082275A1 (fr) Procédé d'authentification de chemin bgp en se basant sur la surveillance saut par saut
Gredler et al. North-bound distribution of link-state and traffic engineering (te) information using bgp
Chuat et al. The Complete Guide to SCION
EP3051758B1 (fr) Traitement de données d'itinéraire
US9762490B2 (en) Content filtering for information centric networks
CN105009509B (zh) 在信息中心网络中通过信任锚点扩增基于名称/前缀的路由协议
US10447653B2 (en) Trusted routing between communication network systems
US9654482B2 (en) Overcoming circular dependencies when bootstrapping an RPKI site
US20160119194A1 (en) Content filtering for information centric networks
Lebovitz et al. Keying and authentication for routing protocols (KARP) design guidelines
US11362837B2 (en) Generating trustable RPL messages having root-signed rank values
JP2011520327A (ja) 通信の信頼性を提供する方法及びシステム
US11546312B2 (en) Dynamic disassociated channel encryption key distribution
Siddiqui et al. A survey on the recent efforts of the Internet Standardization Body for securing inter-domain routing
Testart Reviewing a Historical Internet Vulnerability: Why Isn't BGP More Secure and What Can We Do About it?
Pei et al. A framework for resilient Internet routing protocols
Elamathi et al. Enhanced secure communication over inter-domain routing in heterogeneous wireless networks based on analysis of BGP anomalies using soft computing techniques
Tsumak Securing BGP using blockchain technology
Bakkali et al. Security problems in BGP: An overview
Medved et al. RFC 7752: North-Bound Distribution of Link-State and Traffic Engineering (TE) Information Using BGP
Palmieri et al. Enhanced Security Strategies for MPLS Signaling.
Koole et al. A Comparative Analysis of Routing Policies in BGP and SCION
Li et al. A multi-fence countermeasure based inter-domain source address validation method
Gredler et al. North-Bound Distribution of Link-State and TE Information using BGP draft-ietf-idr-ls-distribution-13
Chi COMP 535 Lecture 6: Routing Security

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14907000

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14907000

Country of ref document: EP

Kind code of ref document: A1